Terraform-aws-eks: Include autoscaling related IAM policies for workers for the cluster-autoscaler

[max-rocket-internet]

Currently we have to add the policy outside this module but I think 90% of people will use the cluster-autoscaler so it would be cool to have it included in this module and perhaps enabled with a variable.
kops currently has this by default here.

The policy would look something like this:

data "aws_iam_policy_document" "eks_node_autoscaling" {
  statement {
    sid    = "eksDemoNodeAll"
    effect = "Allow"

    actions = [
      "autoscaling:DescribeAutoScalingGroups",
      "autoscaling:DescribeAutoScalingInstances",
      "autoscaling:DescribeLaunchConfigurations",
      "autoscaling:DescribeTags",
      "autoscaling:GetAsgForInstance",
    ]

    resources = ["*"]
  }

  statement {
    sid    = "eksDemoNodeOwn"
    effect = "Allow"

    actions = [
      "autoscaling:SetDesiredCapacity",
      "autoscaling:TerminateInstanceInAutoScalingGroup",
      "autoscaling:UpdateAutoScalingGroup",
    ]

    resources = ["*"]

    condition {
      test     = "StringEquals"
      variable = "autoscaling:ResourceTag/Name"
      values   = ["xxxx-eks_asg"]
    }
  }
}

This allows would allow the cluster-autoscaler the access it needs to run correctly.

What do you think?

[brandonjbjelland]

Hello again @max-rocket-internet 👋

Yep, I'm onboard with this as the cluster-autoscaler seems like potentially one of the most used component service (rivaling dashboard). This feels like a step in making the obvious easy.

[max-rocket-internet]

Cool. I'll make a PR.

[max-rocket-internet]

Sorted in this PR https://github.com/terraform-aws-modules/terraform-aws-eks/pull/93

[chrissound]

I seem to be running into this issue. Do I need to explicitly add the terraform data "aws_iam_policy_document" "eks_node_autoscaling" ...?

Currently running into the autoscaling failing with:

Failed to create AWS Manager: cannot autodiscover ASGs: AccessDenied: User: arn:aws:sts::759449713008:assumed-role/terraform-eks-demo-node/i-00882555d2d233b8e is not authorized to perform: autoscaling:DescribeTags